Borrowing it
Nothing to install: this file belongs to optave/ops-codegraph-tool. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/optave/ops-codegraph-tool/main/.claude/skills/test-health/SKILL.mdgit clone --depth 1 https://github.com/optave/ops-codegraph-toolWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/optave/ops-codegraph-tool/test-health)<a href="https://agentmods.dev/skills/optave/ops-codegraph-tool/test-health"><img src="https://agentmods.dev/badge/skills/optave/ops-codegraph-tool/test-health/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/optave/ops-codegraph-tool/test-health"><img src="https://agentmods.dev/badge/skills/optave/ops-codegraph-tool/test-health.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 23 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 43 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 123 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.02458 |
| Opus 5.5 | $0.00012 | $0.00983 |
| Sonnet 5.5 | $0.00006 | $0.00492 |
| Haiku 4.5 | $0.00003 | $0.00246 |
Grade B, and why
test-health scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$RUN_DIR" Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 270 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/test-health — Test Suite Health Audit
Audit the test suite for flaky tests, dead/trivial tests, coverage gaps on recent changes, missing assertions, and structural issues. Produce a health report with prioritized recommendations.
Arguments
$ARGUMENTSmay contain:--flaky-runs N— number of times to run the suite for flaky detection (default: 5)--coverage— only run the coverage gap analysis (skip flaky/dead detection)--quick— skip flaky detection (most time-consuming), run everything else- No arguments — full audit
Phase 0 — Pre-flight
- Confirm we're in the codegraph repo root
- Verify vitest is available:
npx vitest --version - Parse
$ARGUMENTS:FLAKY_RUNS=Nfrom--flaky-runs N(default: 5)COVERAGE_ONLY=trueif--coverageQUICK=trueif--quick
- Discover all test files:
find tests/ \( -name '*.test.js' -o -name '*.test.ts' \) | sort - Count total test files and categorize by directory (integration, parsers, graph, search, unit)
Phase 1 — Flaky Test Detection
Skip if COVERAGE_ONLY or QUICK is set.
Run the full test suite FLAKY_RUNS times and track per-test pass/fail:
RUN_DIR=$(mktemp -d /tmp/test-health-XXXXXX)
for i in $(seq 1 $FLAKY_RUNS); do
timeout 180 npx vitest run --reporter=json > "$RUN_DIR/run-$i.json" 2>"$RUN_DIR/run-$i.err"
exit_code=$?
if [ $exit_code -eq 124 ]; then
echo '{"timeout":true}' > "$RUN_DIR/run-$i.json"
elif [ $exit_code -ne 0 ] && [ $exit_code -ne 1 ]; then
# Use jq to safely JSON-escape stderr content (may contain quotes, newlines, backslashes)
stderr_content=$(cat "$RUN_DIR/run-$i.err")
jq -n --argjson code "$exit_code" --arg stderr "$stderr_content" \
'{"error":true,"exit_code":$code,"stderr":$stderr}' > "$RUN_DIR/run-$i.json"
fi
done
For each run, parse the JSON reporter output from $RUN_DIR/run-$i.json to get per-test results.
After all runs are parsed and analysis is complete, clean up the temporary directory:
rm -rf "$RUN_DIR"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 270 lines · 29 tokens per session scan B 6f433b2eb124
test-health is a skill published in the GitHub repository optave/ops-codegraph-tool (99 stars, last pushed 5d ago), licensed Apache-2.0. It adds 29 tokens to every session and 2,458 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
testatlas
Use for any question about the tests in a .NET test-automation solution (Reqnroll, SpecFlow, NUnit, xUnit, MSTest, Playwright, RestSharp) - finding, identifying, listing or counting the tests, scenarios or step definitions for a feature or keyword, checking whether coverage exists, and before writing, changing or…
index
Build or rebuild the TestAtlas map (codemap.db) for the .NET solution in this project. Use when the session-start note says the map is missing or stale, when the testatlas tools report no map, or after editing .cs or .feature files.
report
Write the TestAtlas HTML report for the .NET solution in this project - a self-contained drill-down of features, scenarios, step bindings, class kinds and endpoints - and optionally the project dependency graph. Use when the person asks for the TestAtlas report, an HTML view or overview of the test suite, a drill-down…
tdd
Test-driven development discipline. Write the failing test first, watch it fail, write minimal code to pass, refactor. No production code without a failing test. No exceptions without explicit permission. Covers red-green-refactor cycle, common rationalizations, and when to start over.
verify
Evidence before assertions. Run verification commands and confirm output before claiming work is complete, fixed, or passing. No 'should work now' — run the command, read the output, then claim the result. Covers tests, builds, linting, agent delegation, and requirement checklists.
scip-integrity-audit
Investigate whether a feature fulfills its promised behavior through live consumers. Find partial implementations, decorative checks, ineffective parser migrations, competing implementations, misleading results, and tests validating their own assumptions.